netdev - [PATCH net-next 0/4] netfilter: updates for net-next

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20260122162935.8581-1-fw@strlen.de>
Date: Thu, 22 Jan 2026 17:29:31 +0100
From: Florian Westphal <fw@...len.de>
To: <netdev@...r.kernel.org>
Cc: Paolo Abeni <pabeni@...hat.com>,
	"David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>,
	<netfilter-devel@...r.kernel.org>,
	pablo@...filter.org
Subject: [PATCH net-next 0/4] netfilter: updates for net-next

Hi,

The following patchset contains nftables fixes for *net-next*.

There is an issue with interval matching in nftables rbtree set type:
When userspace sends us set updates, there is a brief window where
false negative lookups may occur from the data plane.  Quoting Pablos
original cover letter:

This series addresses this issue by translating the rbtree, which keeps
the intervals in order, to binary search. The array is published to
packet path through RCU. The idea is to keep using the rbtree
datastructure for control plane, which needs to deal with updates, then
generate an array using this rbtree for binary search lookups.

Patch #1 allows to call .remove in case .abort is defined, which is
needed by this new approach. Only pipapo needs to skip .remove to speed.

Patch #2 add the binary search array approach for interval matching.

Patch #3 updates .get to use the binary search array to find for
(closest or exact) interval matching.

Patch #4 removes seqcount_rwlock_t as it is not needed anymore (new in
this series).

Please, pull these changes from:
The following changes since commit b00a7b3a612925faa7362f5c61065e3e5f393fff:

  net: atp: drop ancient parallel-port Ethernet driver (2026-01-22 13:32:53 +0100)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next.git tags/nf-next-26-01-22

for you to fetch changes up to 5599fa810b503eafc2bd8cd15bd45f35fc8ff6b9:

  netfilter: nft_set_rbtree: remove seqcount_rwlock_t (2026-01-22 17:18:13 +0100)

----------------------------------------------------------------
netfilter pull request nf-next-26-01-22

----------------------------------------------------------------

Pablo Neira Ayuso (4):
  netfilter: nf_tables: add .abort_skip_removal flag for set types
  netfilter: nft_set_rbtree: translate rbtree to array for binary search
  netfilter: nft_set_rbtree: use binary search array in get command
  netfilter: nft_set_rbtree: remove seqcount_rwlock_t

 include/net/netfilter/nf_tables.h |   2 +
 net/netfilter/nf_tables_api.c     |   3 +-
 net/netfilter/nft_set_pipapo.c    |   2 +
 net/netfilter/nft_set_rbtree.c    | 429 ++++++++++++++++++++----------
 4 files changed, 291 insertions(+), 145 deletions(-)

-- 
2.52.0